The default staleness threshold is 60 days . A CI is considered stale when it has not been updated within the applicable staleness interval. The update may normally come from Discovery, Agent Client Collector, Service Graph Connectors, IntegrationHub ETL, or another governed source.

Staleness is important because an old CI record may no longer represent the actual environment. Stale data can distort service-impact analysis, misdirect incidents, undermine change-risk calculations, and generate inaccurate operational reports. The guide identifies stale CIs as a core CMDB data-quality condition monitored through CMDB Health.

The 60-day value is the default, not an immutable platform rule. Administrators can configure appropriate thresholds by CI class and organizational requirements. Frequently changing cloud resources may require a shorter period, while stable infrastructure may justify a different governed interval.

This question tests understanding of reconciliation source priority in the Identification and Reconciliation Engine (IRE) in ServiceNow.

In reconciliation rules, lower numeric values represent higher priority. Therefore, the priority order is:

ServiceNow (100) – highest authority

Altiris (200)

SCCM (300) – lowest authority

Why A is correct

Because Altiris (200) has higher priority than SCCM (300), data from Altiris can update records originally inserted by SCCM. This is exactly how reconciliation precedence works—higher-priority sources can overwrite lower-priority ones.

Why C is correct

SCCM, even though it has the lowest priority, is still an authorized discovery source. It can insert new records into the Windows Server table when no existing CI is identified. Priority only affects updates, not the ability to create records.

Why B is incorrect

ServiceNow (priority 100) can update records from Altiris and SCCM because it has the highest priority. The statement incorrectly claims it cannot.

Why D is incorrect

SCCM does not have the highest authority. A higher numeric value means lower priority, so SCCM cannot update records created by higher-priority sources.

The Common Service Data Model (CSDM) organizes CMDB data into domains that reflect how services are planned, delivered, and consumed. Correct placement of objects is essential for reporting, ownership, and downstream ITSM, ITOM, and IRM use cases.

Design and Planning domain → Business Process

Business Processes describe how the business operates and what capabilities are required. These are planning constructs used to design services and applications before they are built or delivered.

Foundation domain → Business Application

Business Applications are foundational reference objects that represent what applications exist and who owns them . They anchor ownership, lifecycle, and governance but are not directly operational.

Service Delivery domain → Application Service

Application Services represent running, operational technical services (often created via Service Mapping). They are central to Incident, Change, and Event Management, making them part of Service Delivery.

Sell / Consume domain → Business Service

Business Services represent what is offered to customers or consumers . They define value delivery, SLAs, and consumption context, which is why they belong in the Sell/Consume domain.

This mapping aligns with CSDM v5 guidance and ensures clear separation between planning constructs, foundational records, operational services, and consumer-facing services—a key principle for a scalable and governed CMDB.

CI Class Manager provides a centralized interface for reviewing and configuring the characteristics of each CMDB class. It includes class hierarchy information, attributes, identification rules, reconciliation settings, suggested relationships, principal-class configuration, and related governance information.

Identification rules define the attributes that IRE uses to determine whether incoming data matches an existing CI or should create a new record. Reconciliation settings identify which sources are authorized or prioritized for updating particular attributes. These capabilities allow an administrator to document the authoritative sources and identification criteria for principal CI classes in one management interface.

The CMDB Data Foundations Dashboard identifies foundational quality risks, while CMDB Data Manager controls lifecycle policies. CMDB Workspace is the broader operational interface, but CI Class Manager is the specific tool for class-level configuration and identification governance.

=========

IntegrationHub ETL provides a guided, low-code Extract, Transform, and Load experience. Administrators can define a source, map source fields and relationships to ServiceNow target structures, transform the data through the Robust Transform Engine, and execute recurring imports.

It also integrates with the Identification and Reconciliation Engine for CMDB targets. Incoming CI data is processed against identification rules to determine whether a record should be inserted or updated. Reconciliation rules and source precedence then control whether the source is permitted to update specific attributes.

IntegrationHub ETL does not inherently require SQL or extensive scripting for normal transformations. It also does not replace Discovery or Service Mapping. Discovery actively identifies infrastructure and technical relationships, while Service Mapping builds application-service topology. IntegrationHub ETL primarily imports and transforms data supplied by an external source.

=========

The Related items panel displays records associated with the selected CI, including active incidents, problems, changes, and other task-related information. This allows the Service Desk Manager to move from the CI’s topology to the operational records currently affecting or involving that CI.

The Overview panel presents summarized CI information. The Attributes panel displays field values belonging to the CI. The Application services panel identifies service associations and dependencies, but it is not the primary panel for listing related Incident and Problem records.

Unified Map is intended to combine CI details, relationships, service context, and operational information in a single graphical experience. Its filtering capabilities also allow users to focus on relevant CI types and business-critical elements when analysing a service or CI topology.

Therefore, Related items is the panel that provides the required active task information.

=========

In the CSDM lifecycle model, the Life Cycle Stage represents the broad phase of a CI or asset, while the Life Cycle Stage Status supplies a more precise condition within that phase. When a hardware-backed server reaches End of Life, valid disposition-oriented statuses include Disposed and Donated . These values indicate how the organization concluded responsibility for the physical item after its operational use ended.

“Charity” is not a standard lifecycle status. A charitable transfer would be represented by the standardized status Donated , rather than by creating a separate nonstandard value. “Broken” describes a physical condition and is not the appropriate standardized End-of-Life disposition status in this question.

The Data Foundations material distinguishes Life Cycle Stage as the macro lifecycle phase and Life Cycle Stage Status as its more granular condition. It also identifies “Disposed” as a lifecycle-status value rather than a CMDB Data Manager policy type. ServiceNow likewise defines lifecycle state as the combination of an item’s stage and status.

=========

The CMDB plays a critical role in security operations by providing trusted, structured insight into the organization’s IT landscape. When built according to Data Foundations principles—accurate discovery, governed relationships, and alignment to CSDM—the CMDB becomes an essential enabler for security incident response and vulnerability management.

Option D is correct because the CMDB allows security teams to identify exactly which IT infrastructure components are affected by a vulnerability. By correlating vulnerability scan results with configuration items (CIs), security teams can determine whether an issue exists on a server, application, cloud resource, or network device—and understand where that CI sits within the broader service context. This eliminates blind spots and reduces time spent investigating unknown or unmanaged assets.

Option A is also correct because the CMDB supports assessment and remediation activities during security incidents. Once affected CIs are identified, the CMDB provides ownership, support group, environment, and service relationships. This enables security teams to quickly route remediation tasks to the correct resolver groups, assess business impact, and prioritize response based on service criticality. While the CMDB does not perform remediation itself, it enables informed and coordinated action.

Option B is incorrect because vulnerabilities are not auto-resolved by the CMDB; remediation requires human decision-making and execution through security, patching, or change processes. Option C, while related to governance and compliance use cases, is more aligned with GRC and audit functions rather than day-to-day security operations, making it less appropriate for this question.

In summary, the CMDB’s primary value in security operations is visibility and actionable insight, enabling faster identification, assessment, and response to security threats.

In Data Foundations, “Ingest” is not limited to Discovery. It includes establishing reliable sources and mechanisms to populate and maintain CMDB attributes—especially those that Discovery cannot provide. Warranty expiration dates are a classic example of non-discoverable data: they typically come from procurement systems, asset repositories, vendors, or contract tools rather than from device interrogation.

The correct approach is to maintain these attributes via a scheduled data import from an authoritative external source. This ensures ongoing accuracy and consistency at scale. A scheduled import allows you to define a repeatable integration pattern, apply data quality checks, and keep warranty data current as vendors and procurement records change—without relying on manual updates that inevitably drift over time.

Option A is incorrect because the CMDB Reconciliation Engine resolves conflicts between multiple data sources and applies precedence rules; it does not create the warranty values out of thin air. Reconciliation helps decide which source wins when updates occur, but you still need a source feed providing the warranty attribute values. Option B is also not recommended because creating a new CI class just to hold non-discoverable attributes fragments the model and complicates reporting and processes. Best practice is to keep the attributes on the appropriate hardware CI classes (or related normalized structures, when applicable) and manage them through governed ingestion from authoritative systems. Therefore, C is the best method.

Dynamic reconciliation rules are tied to CMDB 360 / Multisource CMDB because they depend on visibility into multiple contributing data sources for the same CI. Standard reconciliation rules control which data source is allowed to update specific CI attributes based on source precedence, but dynamic reconciliation adds more advanced logic, such as choosing a value based on source reporting behavior or data comparison rules. CMDB Workspace and CMDB Data Manager do not enable dynamic reconciliation; they are management and governance interfaces. Reconciliation Rules alone are not the enabling feature because basic IRE reconciliation can exist without the CMDB 360 dynamic reconciliation capability. Therefore, to use dynamic reconciliation rules, CMDB 360 / Multisource CMDB must be enabled.

=========